javascript / beginner
Snippet
Preventing Cross-Site Scripting with Default HTML Escaping in Svelte
By default, Svelte escapes string expressions wrapped in curly braces to protect against XSS (Cross-Site Scripting) vulnerabilities. Raw HTML strings are treated as plain text unless explicitly rendered with the special @html tag.
snippet.js
javascript
1
2
3
4
5
<script>let userInput = '<img src="x" onerror="alert(1)">';</script><p>Safe render: {userInput}</p>
svelte
Breakdown
1
let userInput = '<img src="x" onerror="alert(1)">';
Defines a potentially dangerous string variable containing malicious HTML and JavaScript payload.
2
<p>Safe render: {userInput}</p>
Renders the string securely as plain text, converting angle brackets into safe HTML entities.